14-07-2025
Two strangers connect over possible breach of private health-care information
Calgarians Tiffany Matson and Kurt Thiessen would never have met if Matson had not received private medical information of Thiessen's in the mail.
Calgarians Tiffany Matson and Kurt Thiessen would never have met if Matson had not received private medical information of Thiessen's in the mail.
Both had filed complaints with the College of Physicians and Surgeons of Alberta (CPSA) last year, and Matson says she has been awaiting a decision for months.
Last week, she received a mail courier at her door that her mom signed off on.
It was a letter from the CPSA.
When she opened it, it was a cover letter with her name, address and case number.
But as she began to read the letter, she found out it was not hers.
'Once I moved on to the second page, I started to notice they were talking about a physician that was not the physician in which I had a complaint about,' Matson told CTV News.
'As I read further down, I noticed that there was another patient's name. This was not my decision—this was not my appeal. This had nothing to do with me. So immediately, I went into investigation work.'
That led her to Thiessen.
'When you get a cold call like that—someone's asking about personal information—it's kind of like, 'Who are you?'' said Thiessen.
'I was rather kind of taken aback by that. I was like, 'That's my personal and private information. Like, why do you have my information?' And she's telling me that she received a courier at the door and how her mom had signed for it and how she had gone on this hunt to find out who I was.
'She took that initiative to contact me, which is like, 'Thank you so very much.''
Thiessen received his letter from the CPSA; however, it appears it had been printed twice, as Matson also had a copy.
Thiessen is a limo driver and was stabbed on June 28, 2020, in downtown Calgary.
He says the college made 'an egregious mistake' by releasing his private information.
'I think somebody needs to know exactly right now what's going on, because how many other victims are there out there?' said Thiessen.
Matson is concerned her letter may have also ended up in the wrong hands and is pleading with anyone who has it to contact her.
'If I had his package, where his information is in my package, then where is my report?' she said.
'I'm terrified of where my information is. This is really confidential information that I don't want out there floating around. And I hope that if somebody does have it, that they keep the same confidence that I did and don't share my results or my appeal with anybody.'
Lorian Hardcastle, an assistant professor in the Faculty of Law at the University of Calgary, said a situation like this 'could be one of two things.'
'It could really, truly be a one-off—a clerical error,' said Hardcastle.
'Or it could be a symptom of a broader pattern of carelessness when it comes to personal information and sending documents to those who have made complaints.'
Hardcastle says the college publishes its decisions on its website, with the complainant's names redacted.
However, in this case, private information has been shared with other people.
'I think that it's incumbent on the college to review this situation and to look at the failings that may have led to this happening and to put in place safeguards to prevent a similar situation in the future,' said Hardcastle.
'Human beings make mistakes, they make clerical errors, and so what we need are systems in place to make sure that those things don't happen.'
Hardcastle adds that if this is a pattern of behaviour from the CPSA in Alberta, there could be further consequences.
'If this is part of a broader pattern or there are other individuals affected, then that's where potentially there'd be a rule for the privacy commissioner to review the information handling practices of the college and to make recommendations about what they can do in the future,' said Hardcastle.
CTV News received a statement from the CPSA on Monday afternoon.
The statement says the CPSA only learned of what happened on Monday morning.
'Even though these situations are rare, we understand how concerning they can be. We have opened an investigation to determine what happened and have contacted the appropriate parties for more information,' the CPSA said.
'CPSA regulates over 14,000 physicians and physician assistants in the province and serves all Albertans. We potentially correspond with hundreds of people a day and while we always strive to be accurate, errors can occur on rare occasions.
'In 2024, CPSA had 10 reported privacy breaches, with none meeting the Office of the Information and Privacy Commissioner of Alberta's (OIPC) reporting requirements.'
The CPSA says the protection of privacy is a responsibility it takes very seriously.
'We are committed to following privacy protocols and in the event of a breach, we take steps to contain it as quickly as possible, document the breach and conduct an assessment to determine risk of harm. If the risk of harm is significant, we notify the individuals impacted and when required, file a report with the OIPC,' the CPSA said.
'We have a public privacy and confidentiality policy available on our website that is compliant with privacy legislation and outlines our responsibilities and accountability to the public.
'If a physician or member of the public suspects a privacy breach may have occurred, we ask that they immediately reach out to CPSA so we can follow our process and minimize further inadvertent spread of confidential information.'
